skills/mukul975/anthropic-cybersecurity-skills/post-exploiting-microsoft-graph-with-graphrunner/Gen Agent Trust Hub
post-exploiting-microsoft-graph-with-graphrunner
Fail
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads an offensive toolset from an external repository (
https://github.com/dafthack/GraphRunner.git) that is not listed as a trusted vendor. - [REMOTE_CODE_EXECUTION]: Instructs the user to import and execute the downloaded PowerShell module (
GraphRunner.ps1), which results in the execution of code from an unverified third-party source. - [DATA_EXFILTRATION]: Automates the searching and extraction of sensitive data from Microsoft 365 services, including mailbox content, SharePoint files, and Teams chats (e.g.,
Invoke-SearchMailbox,Invoke-SearchSharePointAndOneDrive). - [DATA_EXFILTRATION]: Provides explicit instructions to configure persistence through hidden inbox forwarding rules that exfiltrate data to an external email address (
attacker@evil.com). - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection within
scripts/agent.pythrough the following evidence chain: - Ingestion points: Data is ingested from the Microsoft Graph API via
/users,/groups, and/me/messagesendpoints inscripts/agent.py. - Boundary markers: No delimiters or instructions to ignore embedded content are used when processing API responses.
- Capability inventory: The skill has the capability to execute shell commands (
SKILL.mdworkflow) and perform network operations (scripts/agent.pycalls to Graph API). - Sanitization: API response data (such as email subjects or user attributes) is printed or written to files without sanitization or validation.
Recommendations
- AI detected serious security threats
Audit Metadata